Linux kernel “Copy Fail” and “Dirty Frag” flaws give attackers root access to major distributions

A pair of newly disclosed Linux kernel vulnerabilities – CVE‑2026‑31431, nicknamed “Copy Fail”, and the subsequent “Dirty Frag” flaw – have been actively exploited in the wild, allowing unprivileged local users to gain full root privileges on a wide range of popular distributions. The first flaw was publicly revealed on April 29 2026 and was immediately added to the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities catalog. CISA’s advisory, issued under Board Order 22‑01, ordered all federal agencies to patch by May 15 and urged the broader security community to do so without delay. The flaw affects any kernel built between 2017 and the patch, covering Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, SUSE 16, and many other mainstream releases. The exploit works by writing four carefully crafted bytes to the page‑cache of a readable file via the AF_ALG crypto API, then executing a setuid binary such as /usr/bin/su to spawn a root shell. A Python script automates the attack, and the same binary can be used across all affected distributions, creating a vast attack surface.

The second vulnerability, “Dirty Frag”, was disclosed on May 7 2026 and is a local privilege‑escalation flaw that abuses kernel memory‑fragmentation handling. It allows a local user to manipulate kernel memory and gain root privileges without authentication. Like Copy Fail, it remains unpatched; no official fix has yet been released by kernel maintainers. Security teams are advised to monitor for exploitation attempts, apply kernel hardening mitigations, and prioritize patching once distribution maintainers ship a fix. In the meantime, several distributions have back‑ported the Copy Fail patch to newer kernel releases (e.g., Fedora 43’s 6.19.12), but many still run vulnerable kernels.

Cloudflare’s response illustrates the industry’s rapid reaction to the threat. The company’s custom kernel builds, based on LTS 6.12 and 6.18, had already incorporated the upstream fix weeks before the public disclosure. Cloudflare’s security team deployed a runtime mitigation and rolled out the updated kernel across its edge fleet within days, reporting no customer data compromise or service disruption. The incident underscores the importance of keeping kernel LTS versions up to date and maintaining robust behavioral detection to spot anomalous cryptographic exploitation patterns. Administrators running WordPress, WooCommerce, or any unprivileged containerized workloads should verify kernel versions, apply the latest patches, and consider additional hardening such as seccomp and SELinux profiles to mitigate the risk of unauthorized root access.